Mystery file eating by system partition

Severl weeks ago, I got a warning that there was no more space on C:,
my system partition. Properties showed 0 free space. I tracked down
the problem to a file named mnc82DB.tmp, which was about 50GB. It was
in the folder users\owner\appdata\local\temp. I have no idea where it
came from and Google has no entries if I search on that file name.
Trying to delete it fails, saying that it is open in another program.
Rebooting and then deleting it fixes it....

....Temporarily. Today it came back. Same issues. It's very annoying
sice if I try to print something I will lose if I reboot, it won't do
it (0 free space). Another weirdness is that if I try to type
something into the Firefox Goggle engine, the letters are entered in
reverse order.

Anyone have any idea what in the world this is? The OS is Vista
Business x64 SP3.

Look in Task Manager for something suspicious.

There are viruses that write huge files to consume space.
Scan your computer with several online virus programs.

http://www.google.com/search?hl=en&q...anners+&aqi=g2

"Oliver Costich" <oc@5cats.net> wrote in message
news:fqs545t8fed29opnd34n0q1uall2onqv1s@4ax.com...
> Severl weeks ago, I got a warning that there was no more space on C:,
> my system partition. Properties showed 0 free space. I tracked down
> the problem to a file named mnc82DB.tmp, which was about 50GB. It was
> in the folder users\owner\appdata\local\temp. I have no idea where it
> came from and Google has no entries if I search on that file name.
> Trying to delete it fails, saying that it is open in another program.
> Rebooting and then deleting it fixes it....
>
> ...Temporarily. Today it came back. Same issues. It's very annoying
> sice if I try to print something I will lose if I reboot, it won't do
> it (0 free space). Another weirdness is that if I try to type
> something into the Firefox Goggle engine, the letters are entered in
> reverse order.
>
> Anyone have any idea what in the world this is? The OS is Vista
> Business x64 SP3.

On Wed, 24 Jun 2009 21:05:45 -0700, "Spirit" <noone@localhost> wrote:

>Look in Task Manager for something suspicious.
>
>There are viruses that write huge files to consume space.
>Scan your computer with several online virus programs.
>
>http://www.google.com/search?hl=en&q...anners+&aqi=g2

Already used several of these and they found nothing. If it were a
virus, I assume some of these would have the signature since it's been
around several weeks.
>
>"Oliver Costich" <oc@5cats.net> wrote in message
>news:fqs545t8fed29opnd34n0q1uall2onqv1s@4ax.com.. .
>> Severl weeks ago, I got a warning that there was no more space on C:,
>> my system partition. Properties showed 0 free space. I tracked down
>> the problem to a file named mnc82DB.tmp, which was about 50GB. It was
>> in the folder users\owner\appdata\local\temp. I have no idea where it
>> came from and Google has no entries if I search on that file name.
>> Trying to delete it fails, saying that it is open in another program.
>> Rebooting and then deleting it fixes it....
>>
>> ...Temporarily. Today it came back. Same issues. It's very annoying
>> sice if I try to print something I will lose if I reboot, it won't do
>> it (0 free space). Another weirdness is that if I try to type
>> something into the Firefox Goggle engine, the letters are entered in
>> reverse order.
>>
>> Anyone have any idea what in the world this is? The OS is Vista
>> Business x64 SP3.

Well something is writing the file. Right click on File and select
properties, any info? Do you use Symantec/Norton antivirus or
security suite? Try TaskManager and MSCONFIG to see if
you can figure out what is writing the file.

"Oliver Costich" <oc@5cats.net> wrote in message
news:5gd645ld2tud10h70e58628sin30i32nq5@4ax.com...
> On Wed, 24 Jun 2009 21:05:45 -0700, "Spirit" <noone@localhost> wrote:
>
>>Look in Task Manager for something suspicious.
>>
>>There are viruses that write huge files to consume space.
>>Scan your computer with several online virus programs.
>>
>>http://www.google.com/search?hl=en&q...anners+&aqi=g2
>
> Already used several of these and they found nothing. If it were a
> virus, I assume some of these would have the signature since it's been
> around several weeks.
>>
>>"Oliver Costich" <oc@5cats.net> wrote in message
>>news:fqs545t8fed29opnd34n0q1uall2onqv1s@4ax.com. ..
>>> Severl weeks ago, I got a warning that there was no more space on C:,
>>> my system partition. Properties showed 0 free space. I tracked down
>>> the problem to a file named mnc82DB.tmp, which was about 50GB. It was
>>> in the folder users\owner\appdata\local\temp. I have no idea where it
>>> came from and Google has no entries if I search on that file name.
>>> Trying to delete it fails, saying that it is open in another program.
>>> Rebooting and then deleting it fixes it....
>>>
>>> ...Temporarily. Today it came back. Same issues. It's very annoying
>>> sice if I try to print something I will lose if I reboot, it won't do
>>> it (0 free space). Another weirdness is that if I try to type
>>> something into the Firefox Goggle engine, the letters are entered in
>>> reverse order.
>>>
>>> Anyone have any idea what in the world this is? The OS is Vista
>>> Business x64 SP3.

Google ProcessManager by SystemInternals (which was purchased by MS). You
will be able to trace who opens this file.

--
Randem Systems
Your Installation Specialist
The Top Inno Setup Script Generator
http://www.randem.com/innoscript.html
Disk Read Error Press Ctl+Alt+Del to Restart
http://www.randem.com/discus/message...tml?1236319938



"Oliver Costich" <oc@5cats.net> wrote in message
news:fqs545t8fed29opnd34n0q1uall2onqv1s@4ax.com...
> Severl weeks ago, I got a warning that there was no more space on C:,
> my system partition. Properties showed 0 free space. I tracked down
> the problem to a file named mnc82DB.tmp, which was about 50GB. It was
> in the folder users\owner\appdata\local\temp. I have no idea where it
> came from and Google has no entries if I search on that file name.
> Trying to delete it fails, saying that it is open in another program.
> Rebooting and then deleting it fixes it....
>
> ...Temporarily. Today it came back. Same issues. It's very annoying
> sice if I try to print something I will lose if I reboot, it won't do
> it (0 free space). Another weirdness is that if I try to type
> something into the Firefox Goggle engine, the letters are entered in
> reverse order.
>
> Anyone have any idea what in the world this is? The OS is Vista
> Business x64 SP3.

Opps, that's Process Monitor...

--
Randem Systems
Your Installation Specialist
The Top Inno Setup Script Generator
http://www.randem.com/innoscript.html
Disk Read Error Press Ctl+Alt+Del to Restart
http://www.randem.com/discus/message...tml?1236319938



"Oliver Costich" <oc@5cats.net> wrote in message
news:fqs545t8fed29opnd34n0q1uall2onqv1s@4ax.com...
> Severl weeks ago, I got a warning that there was no more space on C:,
> my system partition. Properties showed 0 free space. I tracked down
> the problem to a file named mnc82DB.tmp, which was about 50GB. It was
> in the folder users\owner\appdata\local\temp. I have no idea where it
> came from and Google has no entries if I search on that file name.
> Trying to delete it fails, saying that it is open in another program.
> Rebooting and then deleting it fixes it....
>
> ...Temporarily. Today it came back. Same issues. It's very annoying
> sice if I try to print something I will lose if I reboot, it won't do
> it (0 free space). Another weirdness is that if I try to type
> something into the Firefox Goggle engine, the letters are entered in
> reverse order.
>
> Anyone have any idea what in the world this is? The OS is Vista
> Business x64 SP3.

Vista SP3? Could be part of the problem. It's not real.

http://www.vistax64.com/windows-upda...-pack-3-a.html

Also mentioned here:

http://forum.lowyat.net/topic/1031116

At least one suspected cause is installing an SP2 beta version. Needs to be
uninstalled in order to install the released version of SP2.

There's no such temp file in my Vista HE so I've no real clue as to what
program is creating it. Very few references to "mnc" but one app that I
found using those letters as a file extension is My Notes Center. It
apparently creates an open-ended data base file with .mnc extension. If the
app is installed, speculating that mnc82DB.tmp could be one of its temp
files? In any case, you could try deleting the mnc82DB.tmp file and then
try opening the smaller recreated version in a text editor to look for any
entries within the file that might identify the culprit program.

"Oliver Costich" <oc@5cats.net> wrote in message
news:5gd645ld2tud10h70e58628sin30i32nq5@4ax.com...
> On Wed, 24 Jun 2009 21:05:45 -0700, "Spirit" <noone@localhost> wrote:
>
>>Look in Task Manager for something suspicious.
>>
>>There are viruses that write huge files to consume space.
>>Scan your computer with several online virus programs.
>>
>>http://www.google.com/search?hl=en&q...anners+&aqi=g2
>
> Already used several of these and they found nothing. If it were a
> virus, I assume some of these would have the signature since it's been
> around several weeks.
>>
>>"Oliver Costich" <oc@5cats.net> wrote in message
>>news:fqs545t8fed29opnd34n0q1uall2onqv1s@4ax.com. ..
>>> Severl weeks ago, I got a warning that there was no more space on C:,
>>> my system partition. Properties showed 0 free space. I tracked down
>>> the problem to a file named mnc82DB.tmp, which was about 50GB. It was
>>> in the folder users\owner\appdata\local\temp. I have no idea where it
>>> came from and Google has no entries if I search on that file name.
>>> Trying to delete it fails, saying that it is open in another program.
>>> Rebooting and then deleting it fixes it....
>>>
>>> ...Temporarily. Today it came back. Same issues. It's very annoying
>>> sice if I try to print something I will lose if I reboot, it won't do
>>> it (0 free space). Another weirdness is that if I try to type
>>> something into the Firefox Goggle engine, the letters are entered in
>>> reverse order.
>>>
>>> Anyone have any idea what in the world this is? The OS is Vista
>>> Business x64 SP3.

Try Process Explorer, Process Monitor, and/or FileMon from
Sysinternals to see what is writing that file.

http://technet.microsoft.com/en-us/s.../bb896653.aspx

Get the whole suite, its free :

http://technet.microsoft.com/en-us/s.../bb842062.aspx

"Oliver Costich" <oc@5cats.net> wrote in message
news:5gd645ld2tud10h70e58628sin30i32nq5@4ax.com...
> On Wed, 24 Jun 2009 21:05:45 -0700, "Spirit" <noone@localhost> wrote:
>
>>Look in Task Manager for something suspicious.
>>
>>There are viruses that write huge files to consume space.
>>Scan your computer with several online virus programs.
>>
>>http://www.google.com/search?hl=en&q...anners+&aqi=g2
>
> Already used several of these and they found nothing. If it were a
> virus, I assume some of these would have the signature since it's been
> around several weeks.
>>
>>"Oliver Costich" <oc@5cats.net> wrote in message
>>news:fqs545t8fed29opnd34n0q1uall2onqv1s@4ax.com. ..
>>> Severl weeks ago, I got a warning that there was no more space on C:,
>>> my system partition. Properties showed 0 free space. I tracked down
>>> the problem to a file named mnc82DB.tmp, which was about 50GB. It was
>>> in the folder users\owner\appdata\local\temp. I have no idea where it
>>> came from and Google has no entries if I search on that file name.
>>> Trying to delete it fails, saying that it is open in another program.
>>> Rebooting and then deleting it fixes it....
>>>
>>> ...Temporarily. Today it came back. Same issues. It's very annoying
>>> sice if I try to print something I will lose if I reboot, it won't do
>>> it (0 free space). Another weirdness is that if I try to type
>>> something into the Firefox Goggle engine, the letters are entered in
>>> reverse order.
>>>
>>> Anyone have any idea what in the world this is? The OS is Vista
>>> Business x64 SP3.

could be music downloads.

try deleting it again.

then change your temp
environments to help manage
the temp files and folders.

first created c:\temp

then change your current tmp
and temp files location to the
c:\temp

click on controlpanel>system>
advance>environment variables

modify both user and system
temps.

also, might as well change
your current internet temp
folder to the c:\temp directory
too.

then hold off on rebooting.

next, initiate a clean boot
by clicking on start>msconfig.

go to startup tab and disable
all your startups.

you might want to jot down
what they are.

next go to services tab and
"hide" all microsoft services.

then disable what remains
on the list.

jot these down too.

then reboot the machine.

if that file no longer appears
in your c:\temp folder and
or your disk maintains
free space,

then something you disabled
from msconfig likely attributed
to the problem.

you will have to figure out which
program is the problem and
also consider which startup and
services you disable should be
re-enabled.

--

db·´¯`·...¸><)))º>
DatabaseBen, Retired Professional
- Systems Analyst
- Database Developer
- Accountancy
- Veteran of the Armed Forces
- Microsoft Partner
- @hotmail.com
~~~~~~~~~~"share the nirvana" - dbZen

>
>

"Oliver Costich" <oc@5cats.net> wrote in message news:fqs545t8fed29opnd34n0q1uall2onqv1s@4ax.com...
> Severl weeks ago, I got a warning that there was no more space on C:,
> my system partition. Properties showed 0 free space. I tracked down
> the problem to a file named mnc82DB.tmp, which was about 50GB. It was
> in the folder users\owner\appdata\local\temp. I have no idea where it
> came from and Google has no entries if I search on that file name.
> Trying to delete it fails, saying that it is open in another program.
> Rebooting and then deleting it fixes it....
>
> ...Temporarily. Today it came back. Same issues. It's very annoying
> sice if I try to print something I will lose if I reboot, it won't do
> it (0 free space). Another weirdness is that if I try to type
> something into the Firefox Goggle engine, the letters are entered in
> reverse order.
>
> Anyone have any idea what in the world this is? The OS is Vista
> Business x64 SP3.

"db" <databaseben at hotmail dot com> wrote in message
news:BB7148F6-FB40-4941-8BBB-F89DE46D0F0C@microsoft.com...
<snip>
> next, initiate a clean boot
> by clicking on start>msconfig.
>
> go to startup tab and disable
> all your startups.
>
> you might want to jot down
> what they are.
>
> next go to services tab and
> "hide" all microsoft services.
>
> then disable what remains
> on the list.
>
> jot these down too.
>
> then reboot the machine.
>
> if that file no longer appears
> in your c:\temp folder and
> or your disk maintains
> free space,
>
> then something you disabled
> from msconfig likely attributed
> to the problem.
>
> you will have to figure out which
> program is the problem and
> also consider which startup and
> services you disable should be
> re-enabled.

Lots of stuff to jot down, and get wrong. Is there any command line tool
that will list all this jotted stuff so it can be redirected to a file. Or,
can VBScript access this info directly or through some COM object? Or, is
the info available in the registry, and if so, where?

Thanks,
-Paul Randall